Skip to main content

​
How the allowlist works

Your partner has a list of up to 100 CIDR blocks. When enforcement is on, a request whose source address is outside every block is refused with 403 ip-not-allowed, and the denial is recorded in your audit log as security.ip-denied. The address checked is the original client address of the connection, as reported by Cloudflare, which fronts the API host (CF-Connecting-IP): your outbound NAT or proxy address, not a private address inside your network and not a Cloudflare address. Headers you send yourself, such as X-Forwarded-For, X-Real-IP or CF-Connecting-IP, are ignored or overwritten. Enforcement is the partner setting ipAllowlistEnforcement: Enforcement is effective only with at least one entry, and changes reach every server within 60 seconds.

​
Add your IP ranges

Manage entries on the IP allowlist page of the developer dashboard. The /partner/v1/ip-allowlist operations accept only signed-in users (recent sign-in); API keys can read the list with view-ip-allowlist.
Rules for an entry:
  • IPv4 prefix /8 or longer, IPv6 prefix /32 or longer, in canonical form (host bits zero), for example 203.0.113.0/24 or 2001:db8:1200::/40;
  • no private, loopback or link-local ranges (item code invalid-cidr);
  • a label of 1-80 characters; the same CIDR twice → 409 ip-allowlist-entry-exists; a 101st entry → 422 ip-allowlist-limit-reached.

​
Enable enforcement

  1. Add every egress range of the systems that call the API, IPv4 and IPv6.
  2. Call the API from each system and check that it still works.
  3. Set enforcement in the dashboard (PATCH /partner/v1/partner/settings, manage-settings, dashboard only).
Safety rules:
  • Enabling enforcement with no entry, or deleting the last entry while enforcement is on → 409 ip-allowlist-required.
  • With api-keys-and-users, a change that would exclude your own current address → 422 ip-allowlist-would-lock-out.

​
IPv6

The API host resolves to IPv4 and IPv6 addresses (Cloudflare’s). If your systems have IPv6 connectivity, they may connect over IPv6 and be refused when only IPv4 ranges are listed. Add your IPv6 egress range, or force IPv4 in your HTTP client (for example curl -4).

​
Troubleshooting

  • 403 ip-not-allowed from a server that should be allowed: check the outbound address with a request from that server to a “what is my IP” service, including IPv6.
  • The docs playground fails: the playground runs from Mintlify’s servers, so it is refused while enforcement covers API keys. Use curl from an allowed address.
  • Cloud functions or autoscaling workers: route them through a NAT with fixed addresses.
  • Locked out of the dashboard with api-keys-and-users: another member on an allowed network can change the setting; otherwise contact AllRide support.